{
  "entry": {
    "kind": "vuln",
    "slug": "binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation",
    "name": "binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation",
    "vendor": "binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa",
    "description": "Researchers identified an active npm supply-chain attack that abuses the binding.gyp build mechanism to execute malicious code during install via node-gyp, bypassing many controls that only watch preinstall/postinstall scripts. The worm propagates across packages through CI/CD. Linked to TeamPCP.",
    "website": "https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ci",
    "updatedAt": "2026-06-04",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation",
      "aliases": [
        "ti-040"
      ],
      "title": "binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propagation",
      "summary": "Researchers identified an active npm supply-chain attack that abuses the binding.gyp build mechanism to execute malicious code during install via node-gyp, bypassing many controls that only watch preinstall/postinstall scripts. The worm propagates across packages through CI/CD. Linked to TeamPCP.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Malware"
      ],
      "componentType": "ci",
      "component": {
        "name": "binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "57+ npm packages / 286+ malicious versions with phantom binding.gyp (Miasma wave 2, June 3-4 2026)",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-06-04",
      "modifiedAt": "2026-06-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/"
        }
      ],
      "mitigation": "Audit dependencies for unexpected binding.gyp / node-gyp build steps; disable native build scripts for untrusted packages (e.g. npm --ignore-scripts in CI) and review CI runners for worm propagation since early June.",
      "detectedByAnomity": false
    }
  }
}